Cisco ASA VPN DoS actively exploited (CVE-2026-76418)

Actively exploited in the wild - CVE-2026-76418 is a high-severity denial-of-service vulnerability in Cisco Secure Firewall ASA and FTD Software SSL remote access VPN that lets an unauthenticated, remote attacker crash and reload the device. The flaw triggers under a specific configuration (secondary authentication on a tunnel group); administrators who use that setup should patch or apply the mitigation below without delay.

Overview

Cisco Secure Firewall ASA and FTD Software run the SSL VPN service that many organizations use for remote worker access. CVE-2026-76418 stems from logic errors in how the software handles secondary authentication configured on a tunnel group. When that second authentication step is enabled, a specially crafted request sent during the SSL VPN connection process can push the device into an error state that forces a reload.

An attacker needs no credentials and no user interaction. They only need network reach to the SSL VPN interface and knowledge that the target uses secondary authentication. The CVSS score is 8.6 (HIGH), with the vector showing network attack, low complexity, no privileges, and no user interaction.

Impact

A successful exploit causes the firewall to reload unexpectedly, producing a denial-of-service condition. Every remote-access VPN user connected through that device is dropped, and the firewall stops enforcing policy and inspecting traffic until it finishes rebooting. Repeated attempts can keep the device cycling, extending the outage. Because the crash hits the VPN and firewall roles at once, a single crafted request can interrupt both remote work and network segmentation. CISA has added this CVE to its Known Exploited Vulnerabilities catalog, confirming real-world attacks. The EPSS score is only 0.6%, so broad opportunistic scanning is unlikely, but targeted abuse is proven.

Remediation and Mitigation

• Apply the Cisco software update that addresses CVE-2026-76418. Check the Cisco Security Advisory for the fixed releases per platform (ASA and FTD version lines differ).
• If you cannot patch immediately, remove secondary authentication from SSL VPN tunnel groups where it is not strictly required. This is the configuration condition the exploit depends on.
• Restrict SSL VPN interface exposure to trusted source ranges where operationally possible.
• Monitor for unexpected reloads and repeated failed VPN connection attempts as a signal of exploitation.
• Confirm the fix after upgrading by re-checking your tunnel group authentication settings.

Security Insight

This is the latest in a run of Cisco edge appliances falling to unauthenticated attacks, alongside the SD-WAN Manager auth bypass, the ISE zero-day rated CVSS 10.0, and the Secure Email Gateway flaw. The pattern is consistent: internet-facing management and access planes where a configuration option quietly becomes the attack surface. It reinforces that firewall and VPN appliances deserve the same rapid patch cadence as any externally exposed server.

Further Reading

• Cisco SD-WAN Manager auth bypass exploited, CISA KEV
• Cisco ISE zero-day exploited, CVSS 10.0 auth bypass
• Cisco Secure Email Gateway zero-day actively exploited
• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs